quasar | ca182b6ce56a01a69122b24469fe5ad78e0cda78caeb49e5a814e2ac5774a10a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

1e48869d1ce254c1aba0e61aedcdba8e
SHA1

cf79b1e78d9e1616208e653c4df4eef3b9f7360b
SHA256

ca182b6ce56a01a69122b24469fe5ad78e0cda78caeb49e5a814e2ac5774a10a
SHA512

fc6469a2297258cd9723f2d6c795e78c5b065ed709384bb18fe0fb8255cb2760e0633ec2683652ef88abd87ac21ef1d31eee3fd35e64f464d4da0c205fdcb343
SSDEEP

49152:7vilL26AaNeWgPhlmVqvMQ7XSKeQ03far7ToGddTHHB72eh2NT:7vaL26AaNeWgPhlmVqkQ7XSKu3Y

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.150:4782

Mutex

4fa54cdc-4bee-4759-b0fd-21bb6d6f9eed

Attributes

encryption_key
99A3D9CE1DE6501187FC4C0E50EBB3FE8AD7B9A8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Task Manager Worker Service
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1724-1-0x0000000000B00000-0x0000000000E24000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
behavioral1/memory/1976-8-0x0000000000320000-0x0000000000644000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

1976 Client.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2396 schtasks.exe
2572 schtasks.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client-built.exeClient.exe

description pid process

Token: SeDebugPrivilege 1724 Client-built.exe
Token: SeDebugPrivilege 1976 Client.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Client.exe

pid process

1976 Client.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Client.exe

pid process

1976 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

1976 Client.exe

pid	process
1976	Client.exe

pid	process
2396	schtasks.exe
2572	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1724	Client-built.exe
Token: SeDebugPrivilege	1976	Client.exe

pid	process
1976	Client.exe

pid	process
1976	Client.exe

pid	process
1976	Client.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Client-built.exeClient.exe

description	pid	process	target process
PID 1724 wrote to memory of 2396	1724	Client-built.exe	schtasks.exe
PID 1724 wrote to memory of 2396	1724	Client-built.exe	schtasks.exe
PID 1724 wrote to memory of 2396	1724	Client-built.exe	schtasks.exe
PID 1724 wrote to memory of 1976	1724	Client-built.exe	Client.exe
PID 1724 wrote to memory of 1976	1724	Client-built.exe	Client.exe
PID 1724 wrote to memory of 1976	1724	Client-built.exe	Client.exe
PID 1976 wrote to memory of 2572	1976	Client.exe	schtasks.exe
PID 1976 wrote to memory of 2572	1976	Client.exe	schtasks.exe
PID 1976 wrote to memory of 2572	1976	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Microsoft Task Manager Worker Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Microsoft Task Manager Worker Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2572

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
1e48869d1ce254c1aba0e61aedcdba8e

SHA1
cf79b1e78d9e1616208e653c4df4eef3b9f7360b

SHA256
ca182b6ce56a01a69122b24469fe5ad78e0cda78caeb49e5a814e2ac5774a10a

SHA512
fc6469a2297258cd9723f2d6c795e78c5b065ed709384bb18fe0fb8255cb2760e0633ec2683652ef88abd87ac21ef1d31eee3fd35e64f464d4da0c205fdcb343

Download Submit
memory/1724-0-0x000007FEF5413000-0x000007FEF5414000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x0000000000B00000-0x0000000000E24000-memory.dmp

Filesize
3.1MB

Download
memory/1724-2-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/1724-9-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-8-0x0000000000320000-0x0000000000644000-memory.dmp

Filesize
3.1MB

Download
memory/1976-10-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-11-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-12-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download